CVE-2024-8160CWE-1286

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a…

Low · published November 26, 2024

CVSS v3.1
3.8
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection leading to being able to transfer files from/to the Axis device. This flaw can only be exploited after authenticating with an administrator-privileged service account.

Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00637 · 49.9th percentile
Weakness
CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published
2024-11-26T07:27Z
EPSS history
Timeline
  • 26 NOV 07:27Z
    Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a…
    cvelistv5